Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hashicorp/terraform
main @ 88ace66
124
Fixes
5
CVEs
CRITICAL
Peak severity
27.0%
Coverage
Highlights
Denial of Service: 58 prior fixes. Scrutinize any change in this area.
command: most-fixed (6 issues). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Verification Bypass: Historically, the provider installation mechanism suffered from signature verification bypasses and lacked cryptographic checks on downloaded binaries, enabling potential execution of tampered code. Solidifying verification using hardcoded and updated PGP public key blocks is critical.
Information Disclosure: Delicate handling of sensitive fields is a constant regression vector. Secrets frequently leak into error diagnostics, run logs, and plan outputs when sensitivity marks fail to propagate or are stripped during evaluations (e.g., in module outputs, plan reads, and dynamic validations).
Path Traversal: Workspace names and test directories are vulnerable to path traversal attacks when reading local metadata files or establishing test execution context boundaries. Proper path canonicalization and strict verification of expected configuration directory parentage are required.